2b1750f3a04f0889599bb1027fc1b640_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2b1750f3a04f0889599bb1027fc1b640_NeikiAnalytics.exe
Size

491KB
MD5

2b1750f3a04f0889599bb1027fc1b640
SHA1

48c097de5b423080e5862d2fabbdc9e260df25b9
SHA256

6916ad2325133c7de88fbd0849d98a3c365d2e3ae8fda9898334b4b365396c92
SHA512

88d9d368e489a1d2488628d358a8dae25184b1edb7555a8883e43f164041dc67a34b18cc1b468276a03e679f746bf7e842e8ea706a6a2fb08356e065096c196e
SSDEEP

12288:Xl/bSK7+JaIBV45d36lgOkxE45ZAQrenObOZahVkDVbpTUiwL:wDBmaQX3hGDV1Tpw

Score

1^/10

Malware Config

Signatures

Files

2b1750f3a04f0889599bb1027fc1b640_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

ff39725db8735d375d3d16dc77ba89cd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

46:c1:8f:66:01:63:3d:ae:52:ff:d9:a4:fa:16:2f:40
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-11-2013 00:00

Not After

09-02-2017 23:59

Subject

CN=BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=TECHNOLOGY PRODUCTS DEPARTMENT,O=BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.\,LTD.,L=BEIJING,ST=BEIJING,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:6d:8c:6d:05:1a:5b:53:db:95:04:11:a2:a2:c0:5e
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31-12-2015 00:00

Not After

09-02-2017 23:59

Subject

CN=BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.\,LTD.,OU=TECHNOLOGY PRODUCTS DEPARTMENT,O=BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.\,LTD.,L=BEIJING,ST=BEIJING,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11-06-2015 00:00

Not After

29-12-2020 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01-01-1997 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:e2:c3:16:03:23:06:aa:ed:88:04:92:d2:00:47:91:39:14:28:3f:81:18:76:79:4a:4c:cf:25:c9:19:4d:fd
Signer

Actual PE Digest

08:e2:c3:16:03:23:06:aa:ed:88:04:92:d2:00:47:91:39:14:28:3f:81:18:76:79:4a:4c:cf:25:c9:19:4d:fd

Digest Algorithm

sha256

PE Digest Matches

true

27:fd:21:5f:39:c1:2a:10:e7:c1:3b:3e:20:09:90:e7:38:7c:bc:4b
Signer

Actual PE Digest

27:fd:21:5f:39:c1:2a:10:e7:c1:3b:3e:20:09:90:e7:38:7c:bc:4b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\QiyiCode\tag\tag4.3.1\PublishNativeCore\VideoLibrary.pdb

Imports

ws2_32

WSAGetLastError
gethostname
gethostbyname
inet_addr
ntohl
ntohs
htonl
htons
accept
connect
getpeername
getsockname
listen
recvfrom
recv
send
bind
socket
setsockopt
ioctlsocket
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
WSASetEvent
WSACloseEvent
closesocket
WSACleanup
WSAStartup
sendto

quilib

?SetMaxHeight@CControlUI@DuiLib@@UAEXH@Z
?GetMaxHeight@CControlUI@DuiLib@@UBEHXZ
?SetMinHeight@CControlUI@DuiLib@@UAEXH@Z
?SetRelativeParentSize@CControlUI@DuiLib@@UAEXUtagSIZE@@@Z
?SetRelativePos@CControlUI@DuiLib@@UAEXUtagSIZE@@0@Z
?GetRelativePos@CControlUI@DuiLib@@UBE?AUtagTRelativePosUI@2@XZ
?IsRelativePos@CControlUI@DuiLib@@UBE_NXZ
?GetToolTip@CLabelUI@DuiLib@@UBE?AVCStdString@2@XZ
?SetToolTip@CControlUI@DuiLib@@UAEXPB_W@Z
?SetToolTip@CControlUI@DuiLib@@UAEXPB_WH@Z
?SetMaxWidth@CControlUI@DuiLib@@UAEXH@Z
?GetMaxWidth@CControlUI@DuiLib@@UBEHXZ
?SetMinWidth@CControlUI@DuiLib@@UAEXH@Z
?GetMinWidth@CControlUI@DuiLib@@UBEHXZ
?SetFixedHeight@CControlUI@DuiLib@@UAEXH@Z
?GetFixedHeight@CControlUI@DuiLib@@UBEHXZ
?SetFixedWidth@CControlUI@DuiLib@@UAEXH@Z
?SetToolTipWidth@CControlUI@DuiLib@@UAEXH@Z
?GetToolTipWidth@CControlUI@DuiLib@@UAEHXZ
?GetShortcut@CControlUI@DuiLib@@UBE_WXZ
?SetShortcut@CControlUI@DuiLib@@UAEX_W@Z
?IsContextMenuUsed@CControlUI@DuiLib@@UBE_NXZ
?SetContextMenuUsed@CControlUI@DuiLib@@UAEX_N@Z
?OnResourceMessage@CWindowWnd@DuiLib@@MAEXHPAVCResourceArg@@@Z
?MessageHandler@CPaintManagerUI@DuiLib@@QAE_NIIJAAJ@Z
?HandleMessage@CWindowWnd@DuiLib@@MAEJIIJ@Z
?GetInstancePath@CPaintManagerUI@DuiLib@@SA?AVCStdString@2@XZ
?GetData@CStdString@DuiLib@@QAEPB_WXZ
?GetHWND@CWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
?GetFixedWidth@CControlUI@DuiLib@@UBEHXZ
?SetFixedXY@CControlUI@DuiLib@@UAEXUtagSIZE@@@Z
?GetFixedXY@CControlUI@DuiLib@@UBE?AUtagSIZE@@XZ
?SetPadding@CControlUI@DuiLib@@UAEXUtagRECT@@@Z
?GetPadding@CControlUI@DuiLib@@UBE?AUtagRECT@@XZ
?GetY@CControlUI@DuiLib@@UBEHXZ
?GetX@CControlUI@DuiLib@@UBEHXZ
?GetHeight@CControlUI@DuiLib@@UBEHXZ
?GetWidth@CControlUI@DuiLib@@UBEHXZ
?SetPos@CControlUI@DuiLib@@UAEXUtagRECT@@@Z
?GetPos@CControlUI@DuiLib@@UBEABUtagRECT@@XZ
?SetText@CLabelUI@DuiLib@@UAEXPB_W@Z
?GetText@CLabelUI@DuiLib@@UBE?AVCStdString@2@XZ
?IsPluginControlUI@CControlUI@DuiLib@@UAE_NXZ
?SetPluginName@CControlUI@DuiLib@@UAEXPB_W@Z
?GetPluginName@CControlUI@DuiLib@@UBE?AVCStdString@2@XZ
?SetParent@CControlUI@DuiLib@@UAEXPAV12@@Z
?GetParent@CControlUI@DuiLib@@UBEPAV12@XZ
?SetManager@CControlUI@DuiLib@@UAEXPAVCPaintManagerUI@2@PAV12@_N@Z
?Activate@CControlUI@DuiLib@@UAE_NXZ
?GetControlFlags@CControlUI@DuiLib@@UBEIXZ
?GetInterface@CLabelUI@DuiLib@@UAEPAXPB_W@Z
?GetClass@CLabelUI@DuiLib@@UBEPB_WXZ
?SetName@CControlUI@DuiLib@@UAEXPB_W@Z
?GetName@CControlUI@DuiLib@@UBE?AVCStdString@2@XZ
?Init@CPaintManagerUI@DuiLib@@QAEXPAUHWND__@@@Z
??0CDialogBuilder@DuiLib@@QAE@XZ
?GetInstance@?$CSingletonBase@VCUISystem@@@@SAPAVCUISystem@@XZ
?GetControlCreator@CUISystem@@QAEPAVIDialogBuilderCallback@DuiLib@@PB_W@Z
?Create@CDialogBuilder@DuiLib@@QAEPAVCControlUI@2@VSTRINGorID@2@PB_WPAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@1@Z
?AttachDialog@CPaintManagerUI@DuiLib@@QAE_NPAVCControlUI@2@@Z
?AddNotifier@CPaintManagerUI@DuiLib@@QAE_NPAVINotifyUI@2@@Z
??1CDialogBuilder@DuiLib@@QAE@XZ
?Create@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKKHHHHPAUHMENU__@@@Z
?SetHandCursor@CButtonUI@DuiLib@@QAEX_N@Z
?EventClick@CControlUI@DuiLib@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@A
?Subscribe@CEventSets@DuiLib@@QAEXV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVCDelegateBase@2@@Z
?SetTextStyle@CLabelUI@DuiLib@@QAEXI@Z
?SetTextPadding@CLabelUI@DuiLib@@QAEXUtagRECT@@@Z
??0CLabelUI@DuiLib@@QAE@XZ
?SetTextColor@CLabelUI@DuiLib@@QAEXK@Z
?SetFont@CLabelUI@DuiLib@@QAEXPB_W@Z
?GetSuperClassName@CWindowWnd@DuiLib@@MBEPB_WXZ
?ShowWindow@CWindowWnd@DuiLib@@UAEX_N0@Z
?GetDefaultStoryboardName@CWindowWnd@DuiLib@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?Stop@CQuiTimer@@QAEXXZ
??0CQuiTimer@@QAE@W4E_QUITIMER_TYPE@@PAVIQuiTimerHandler@@_N2@Z
?Start@CQuiTimer@@QAEXIPAVIQuiTimerHandler@@@Z
??1CQuiTimer@@QAE@XZ
??0IQuiTimerHandler@@QAE@XZ
??0CWindowWnd@DuiLib@@QAE@XZ
??0CPaintManagerUI@DuiLib@@QAE@XZ
??1CWindowWnd@DuiLib@@QAE@XZ
??1CPaintManagerUI@DuiLib@@QAE@XZ
??0CDelegateBase@DuiLib@@QAE@ABV01@@Z
?GetObjectW@CDelegateBase@DuiLib@@IAEPAXXZ
??0CDelegateBase@DuiLib@@QAE@PAX0@Z
?GetFont@CLabelUI@DuiLib@@QBE?AVCStdString@2@XZ
??BCStdString@DuiLib@@QBEPB_WXZ
?GetTextExtent@CPaintManagerUI@DuiLib@@QAE?AUtagSIZE@@PB_W0@Z
??1CStdString@DuiLib@@QAE@XZ
?SetDisabledTextColor@CLabelUI@DuiLib@@QAEXK@Z
??1CLabelUI@DuiLib@@UAE@XZ
??1CDelegateBase@DuiLib@@UAE@XZ
?GetActualText@CLabelUI@DuiLib@@UAE?AVCStdString@2@XZ
?InitializeCssNode@CControlUI@DuiLib@@UAEXXZ
?Measure@CLabelUI@DuiLib@@MAE?AUcss_dim_t@@M@Z
?OnFocusOutAnimationEnd@CControlUI@DuiLib@@UAE_NXZ
?OnFocusInAnimationEnd@CControlUI@DuiLib@@UAE_NXZ
?SetFixedWidth_New@CControlUI@DuiLib@@UAEXH@Z
?ReleaseTemplate@CControlUI@DuiLib@@UAEXXZ
?SetBKBitmap@CControlUI@DuiLib@@UAEXPAUHBITMAP__@@@Z
?OnMessage@CControlUI@DuiLib@@UAEJIIJ@Z
?GetIDataPtr@CControlUI@DuiLib@@UAEPAXXZ
?SetScriptData@CControlUI@DuiLib@@UAEXAAVValue@Json@@@Z
?SetTransparent@CControlUI@DuiLib@@UAEXE@Z
?DoPostPaint@CControlUI@DuiLib@@UAEXPAUHDC__@@ABUtagRECT@@@Z
?ExcludingClipRect@CControlUI@DuiLib@@UAEXPAUHDC__@@@Z
?PaintBorder@CControlUI@DuiLib@@UAEXPAUHDC__@@@Z
?PaintText@CLabelUI@DuiLib@@UAEXPAUHDC__@@@Z
?PaintStatusImage@CControlUI@DuiLib@@UAEXPAUHDC__@@@Z
?PaintBkImage@CControlUI@DuiLib@@UAEXPAUHDC__@@@Z
?PaintBkColor@CControlUI@DuiLib@@UAEXPAUHDC__@@@Z
?DoPaint@CControlUI@DuiLib@@UAEXPAUHDC__@@ABUtagRECT@@@Z
?EstimateSize@CLabelUI@DuiLib@@UAE?AUtagSIZE@@U3@@Z
?SetAttribute@CLabelUI@DuiLib@@UAEXPB_W0@Z
?DoEvent@CLabelUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?Event@CControlUI@DuiLib@@UAEXAAUtagTEventUI@2@@Z
?DoInit@CControlUI@DuiLib@@UAEXXZ
?Init@CControlUI@DuiLib@@UAEXXZ
?FindControl@CControlUI@DuiLib@@UAEPAV12@P6GPAV12@PAV12@PAX@Z1I@Z
?GetTabstop@CControlUI@DuiLib@@UAE_NXZ
?EnableTabstop@CControlUI@DuiLib@@UAEX_N@Z
?ToLoseFocus@CControlUI@DuiLib@@UAEXXZ
?SetFlat@CControlUI@DuiLib@@UAEX_N@Z
?SetFloat@CControlUI@DuiLib@@UAEX_N@Z
?IsFloat@CControlUI@DuiLib@@UBE_NXZ
?SetFocus@CControlUI@DuiLib@@UAEXXZ
?IsFocused@CControlUI@DuiLib@@UBE_NXZ
?SetKeyboardEnabled@CControlUI@DuiLib@@UAEX_N@Z
?IsKeyboardEnabled@CControlUI@DuiLib@@UBE_NXZ
?SetMouseEnabled@CControlUI@DuiLib@@UAEX_N@Z
?IsMouseEnabled@CControlUI@DuiLib@@UBE_NXZ
?SetEnabled@CControlUI@DuiLib@@UAEX_N@Z
?IsEnabled@CControlUI@DuiLib@@UBE_NXZ
?SetInternVisible@CControlUI@DuiLib@@UAEX_N@Z
?SetVisible@CControlUI@DuiLib@@UAEX_N@Z
?IsVisible@CControlUI@DuiLib@@UBE_NXZ
?GetVisible@CControlUI@DuiLib@@UBE_NXZ
?SetTag@CControlUI@DuiLib@@UAEXI@Z
?GetTag@CControlUI@DuiLib@@UBEIXZ
?SetUserData@CControlUI@DuiLib@@UAEXPB_W@Z
?GetUserData@CControlUI@DuiLib@@UAEABVCStdString@2@XZ
?GetMinHeight@CControlUI@DuiLib@@UBEHXZ

apppluginbase

??1scoped_pluginptr@@QAE@XZ
??0CPluginDelegateBase@@QAE@PAX0@Z
?GetObjectW@CPluginDelegateBase@@IAEPAXXZ
??0CPluginDelegateBase@@QAE@ABV0@@Z
??1CMessageRelayer@@UAE@XZ
??0scoped_pluginptr@@QAE@XZ
??0scoped_pluginptr@@QAE@ABV0@@Z
??4scoped_pluginptr@@QAEAAV0@ABV0@@Z
?GetPlugin@CServiceManager@@QAE?AVscoped_pluginptr@@PBDPAVIPluginHost@@PB_W@Z
?GetInstance@CServiceManager@@SAPAV1@XZ
??4scoped_pluginptr@@QAEAAV0@PAVIPlugin@@@Z
?SendToPeer@CPluginProxyBase@@QAEXPAVCIpcData@@@Z
??1IProcessorFactory@@UAE@XZ
??1CDefaultService@@UAE@XZ
??0IProcessorFactory@@QAE@XZ
??0CDefaultService@@QAE@XZ
?Subscribe@CDefaultService@@UAEXPB_WAAVCPluginDelegateBase@@@Z
?UnSubscribe@CDefaultService@@UAEXPB_WAAVCPluginDelegateBase@@@Z
?FireEvent@CDefaultService@@UAE_NPB_WPAX@Z
?IsUIPlugin@IPlugin@@UAE_NXZ
?DestoryPluginEntry@CDefaultService@@UAEXXZ
?ProcessRemoteEvent@IPlugin@@UAEPAUsEventInfo@@PAVCIpcData@@@Z
?GetWeakRef@CDefaultService@@UAE?AVWeakReference@internal@base@@XZ
?NativeCall@CDefaultService@@UAEPBDPBD0@Z
??1IServerProcessor@@UAE@XZ
??0IServerProcessor@@QAE@XZ
??1CDefaultProxyService@@UAE@XZ
??0CDefaultProxyService@@QAE@XZ
?Subscribe@CDefaultProxyService@@UAEXPB_WAAVCPluginDelegateBase@@@Z
?UnSubscribe@CDefaultProxyService@@UAEXPB_WAAVCPluginDelegateBase@@@Z
?FireEvent@CDefaultProxyService@@UAE_NPB_WPAX@Z
?DestoryPluginEntry@CDefaultProxyService@@UAEXXZ
?OnCmdline@CDefaultProxyService@@UAEXPB_W@Z
?SetAttribute@CDefaultProxyService@@UAEXPB_W0@Z
?GetWeakRef@CDefaultProxyService@@UAE?AVWeakReference@internal@base@@XZ
?NativeCall@CDefaultProxyService@@UAEPBDPBD0@Z
??1IClientProxy@@UAE@XZ
??0IClientProxy@@QAE@XZ
?get@scoped_pluginptr@@QAEPAVIPlugin@@XZ
??Cscoped_pluginptr@@QBEPAVIPlugin@@XZ
??1CPluginDelegateBase@@UAE@XZ
?doWindowProc@CMessageRelayer@@UAEJIIJAA_N@Z
??0CMessageRelayer@@QAE@PAVIRelayMessageHandler@@PA_W@Z

gbase

?is_valid@WeakReference@internal@base@@QBE_NXZ
?get_dcheck_state@logging@@YA?AW4DcheckState@1@XZ
?GetMinLogLevel@logging@@YAHXZ
??0LogMessage@logging@@QAE@PBDHH@Z
?stream@LogMessage@logging@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
??0WeakPtrBase@internal@base@@IAE@ABVWeakReference@12@@Z
??1WeakReference@internal@base@@QAE@XZ
??1WeakPtrBase@internal@base@@QAE@XZ
??1LogMessage@logging@@QAE@XZ

mfc100u

ord4645
ord4794
ord4623
ord6931
ord6932
ord6922
ord4792
ord7393
ord9328
ord8346
ord6140
ord890
ord1292
ord6869
ord1440
ord4959
ord423
ord4197
ord4216
ord7353
ord4956
ord4150
ord7914
ord2620
ord2529
ord981
ord316
ord4292
ord4514
ord903
ord4151
ord2614
ord5264
ord285
ord13127
ord2629
ord4512
ord8483
ord5115
ord4923
ord4642
ord11845
ord13572
ord1479
ord4290
ord7357
ord4511
ord5118
ord11838
ord5229
ord286
ord11801
ord7524
ord1310
ord280
ord1298
ord1450
ord265
ord266
ord1312
ord296
ord902
ord1300
ord11209
ord11240
ord9498
ord7391
ord4086
ord11236
ord11228
ord5261
ord3416
ord13568
ord13571
ord13569
ord13567
ord13570
ord7179
ord11469
ord13267
ord10976
ord14162
ord1739
ord7126
ord11864
ord3625
ord3684
ord8530
ord13387
ord7108
ord13381
ord11477
ord11476
ord2164
ord4744
ord13854
ord11784
ord7548
ord7624
ord1990
ord11494
ord4901
ord908
ord13605
ord2091
ord322
ord2055
ord2053
ord2080
ord1984
ord2045
ord3413
ord408
ord1953
ord2090
ord2088
ord1945
ord1873
ord1934
ord323
ord1301
ord7176

msvcr100

fclose
__CxxFrameHandler3
fflush
_snprintf_s
fopen
_stat64i32
__RTDynamicCast
strnlen
_vscprintf
vsprintf_s
_errno
printf
strstr
strtol
_memicmp
_wfopen
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_except_handler4_common
?terminate@@YAXXZ
_vsnprintf
_itoa
tolower
fread
fseek
memcpy
ftell
fwrite
memset
memmove
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
_i64tow
_itow_s
free
calloc
_recalloc
_purecall
_wtoi64
_wtoi
_wrename
atoi
_stricmp
sprintf_s
isspace
sprintf
isalnum
memchr
wcschr
wcsrchr
_vscwprintf
vswprintf_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
__iob_func
memcpy_s
memmove_s
_wcsicmp
swprintf_s
wcstod
wcstol
_wcsnicmp
strpbrk
malloc
sscanf
fprintf

kernel32

CreateDirectoryW
CopyFileW
DeleteFileW
RemoveDirectoryW
WaitForSingleObject
CreateProcessW
CloseHandle
CreateMutexW
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WriteFile
CreateFileW
GetTempPathW
QueryPerformanceFrequency
QueryPerformanceCounter
TlsGetValue
TlsSetValue
RaiseException
TerminateThread
SetThreadLocale
ResumeThread
SetThreadPriority
CreateThread
InterlockedDecrement
TlsFree
TlsAlloc
MultiByteToWideChar
OutputDebugStringA
InterlockedIncrement
CreateEventW
ResetEvent
SetEvent
LocalFree
LoadLibraryA
WaitForMultipleObjects
GetCurrentThreadId
LocalAlloc
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
lstrlenW
WideCharToMultiByte
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetProcAddress
LoadLibraryW
SystemTimeToFileTime
GetLocalTime
GetSystemInfo
GetModuleHandleW
GetVersionExW
GetLastError
FreeLibrary
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
lstrlenA

user32

PostMessageW
PostThreadMessageW
EqualRect
GetParent
FindWindowExW
GetWindow
GetClientRect
SetParent
SetWindowPos
GetForegroundWindow
SetTimer
KillTimer

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
OleRun

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

msvcp100

?width@ios_base@std@@QAE_J_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_BADOFF@std@@3_JB
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

dbghelp

MakeSureDirectoryPathExists

Exports

Exports

CreatePlugin
CreateProxy

Sections

.text
Size: 345KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff39725db8735d375d3d16dc77ba89cd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

46:c1:8f:66:01:63:3d:ae:52:ff:d9:a4:fa:16:2f:40Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

22:6d:8c:6d:05:1a:5b:53:db:95:04:11:a2:a2:c0:5eCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

08:e2:c3:16:03:23:06:aa:ed:88:04:92:d2:00:47:91:39:14:28:3f:81:18:76:79:4a:4c:cf:25:c9:19:4d:fdSigner

27:fd:21:5f:39:c1:2a:10:e7:c1:3b:3e:20:09:90:e7:38:7c:bc:4bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

quilib

apppluginbase

gbase

mfc100u

msvcr100

kernel32

user32

advapi32

shell32

shlwapi

ole32

oleaut32

msvcp100

dbghelp

Exports

Exports

Sections

.text Size: 345KB - Virtual size: 345KB

.rdata Size: 91KB - Virtual size: 90KB

.data Size: 6KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 32KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

46:c1:8f:66:01:63:3d:ae:52:ff:d9:a4:fa:16:2f:40
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

22:6d:8c:6d:05:1a:5b:53:db:95:04:11:a2:a2:c0:5e
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

08:e2:c3:16:03:23:06:aa:ed:88:04:92:d2:00:47:91:39:14:28:3f:81:18:76:79:4a:4c:cf:25:c9:19:4d:fd
Signer

27:fd:21:5f:39:c1:2a:10:e7:c1:3b:3e:20:09:90:e7:38:7c:bc:4b
Signer

.text
Size: 345KB - Virtual size: 345KB

.rdata
Size: 91KB - Virtual size: 90KB

.data
Size: 6KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 32KB